Every Charlotte and Falcon agent action,
independently judged before it executes.

# Falcon Fusion SOAR workflow — step 1 asks Veridect; the response action runs only on greenlight
trigger: Charlotte AI / AgentWorks agent proposes a response action
actions:
  - name: Veridect pre-action                              # HTTP (REST) action
    method: POST
    url: https://<your-veridect-host>/api/ai/consensus/pre-action
    headers: { Authorization: "Bearer ${credential.veridect_key}", Content-Type: application/json }
    body:
      action:            ${trigger.action}                   # e.g. "update_detection_status"
      target:            falcon:${trigger.object_type}       # e.g. "falcon:detection"
      parameters:        ${trigger.parameters}
      callingAgent:      "<agent-id>"                          # a workflow constant: the agent this workflow belongs to — not a trigger field
      callingAgentScope: "<its configured authority, in words>"  # a workflow constant set when the workflow is built — never a trigger field
    timeout_seconds: 60

  - condition: ${actions.veridect_pre_action.body.verdict} == "greenlight"   # a failed step never reaches true
    then:
      - run the response action                              # the work step — the record id goes into the comment
      - add comment: "Veridect greenlight · record ${actions.veridect_pre_action.body.auditBundleId}"
    else:
      - notify the queue: "Not executed — Veridect ${actions.veridect_pre_action.body.verdict} · record ${actions.veridect_pre_action.body.auditBundleId}"

# Foundry function "governed_action" — the only path from an agent to a Falcon mutation
import os, json, urllib.request
from crowdstrike.foundry.function import Function, Request, Response
func = Function.instance()

AGENT_AUTHORITY = {                                                        # authority keyed by the agent's identity — your configuration, never a body field
    "<triage-agent-client-id>": "may update detection status and add comments; may not change prevention policies or contain hosts",
    "<hunter-agent-client-id>": "read-only: may query detections, hosts and identity events; may not modify any Falcon object",
}
ALLOWED = {"update_detection_status", "add_detection_comment", "disable_prevention_policy", "contain_host"}   # the mutations this function knows how to perform

@func.handler(method="POST", path="/governed-action")
def governed_action(request: Request) -> Response:
    b = request.body
    agent_id = caller_identity(request)                                    # the API client / app identity Falcon attached to this invocation — not b["agent_id"]
    scope = AGENT_AUTHORITY.get(agent_id)
    if scope is None or b.get("action") not in ALLOWED:
        return Response(code=403, body={"executed": False, "verdict": "unknown_agent_or_action"})   # never asked, never run
    verdict, record_id = "unavailable", ""                                 # closed until proven open
    try:
        req = urllib.request.Request("https://<your-veridect-host>/api/ai/consensus/pre-action", method="POST",
            data=json.dumps({"action": b["action"], "target": "falcon:" + b["object_type"],
                             "parameters": b["parameters"], "callingAgent": agent_id,
                             "callingAgentScope": scope,                          # its configured authority, in words
                             "department": "security_operations"}).encode(),
            headers={"Content-Type": "application/json",
                     "Authorization": "Bearer " + os.environ["VERIDECT_API_KEY"]})
        with urllib.request.urlopen(req, timeout=60) as r:
            d = json.load(r) if r.status == 200 else {}
        verdict, record_id = d.get("verdict", "unavailable"), d.get("auditBundleId", "")
    except Exception:
        pass                                                               # network, timeout, parse: all stay closed
    if verdict != "greenlight":
        return Response(code=200, body={"executed": False, "verdict": verdict, "record_id": record_id})
    result = falcon_api(b["action"], b["parameters"], comment="Veridect record " + record_id)   # the mutation, record id in its comment
    ok = result.get("status_code") == 200 and not result.get("errors")                 # Falcon's own answer decides "executed"
    return Response(code=200, body={"executed": ok, "verdict": "greenlight", "record_id": record_id, "result": result})

# 1) once — register the real tool server as an upstream (admin call)
POST /api/ai/consensus/mcp/upstreams/{tenant}
{ "upstreamId": "falcon-tools-prod", "url": "https://<your-tool-server>/mcp", "enabled": true }

# 2a) a Falcon agent reaching an external tool server — the MCP server URL in its configuration
before:  https://<your-tool-server>/mcp
after:   https://<your-veridect-host>/api/mcp/gateway/falcon-tools-prod

# 2b) an external agent reaching Falcon tools — the same change, the other way round
before:  https://<your-falcon-mcp-server>/mcp
after:   https://<your-veridect-host>/api/mcp/gateway/falcon-mcp-prod
HEADERS = {
  "Authorization":            "Bearer <VERIDECT_API_KEY>",            # your Veridect tenant
  "X-Upstream-Authorization": "Bearer <Falcon OAuth2 token>",         # forwarded to the upstream as Authorization
}

# 3) what the agent sees on a greenlight: the upstream's own result, plus
#    result._meta["veridect/verdict"] and result._meta["veridect/bundleId"]
#    on escalate / block: a JSON-RPC error (-32003 / -32004) carrying the
#    verdict and the record id — and the server never receives the call.